py2docfx 0.1.16rc2051518__py3-none-any.whl → 0.1.17__py3-none-any.whl

py2docfx/venv/venv1/Lib/site-packages/cryptography/hazmat/primitives/serialization/ssh.py

@@ -169,20 +169,20 @@ def _ecdsa_key_type(public_key: ec.EllipticCurvePublicKey) -> bytes:
 
 
 def _ssh_pem_encode(
-    data: bytes,
+    data: utils.Buffer,
     prefix: bytes = _SK_START + b"\n",
     suffix: bytes = _SK_END + b"\n",
 ) -> bytes:
     return b"".join([prefix, _base64_encode(data), suffix])
 
 
-def _check_block_size(data: bytes, block_len: int) -> None:
+def _check_block_size(data: utils.Buffer, block_len: int) -> None:
     """Require data to be full blocks"""
     if not data or len(data) % block_len != 0:
         raise ValueError("Corrupt data: missing padding")
 
 
-def _check_empty(data: bytes) -> None:
+def _check_empty(data: utils.Buffer) -> None:
     """All data should have been parsed."""
     if data:
         raise ValueError("Corrupt data: unparsed data")
@@ -196,7 +196,9 @@ def _init_cipher(
 ) -> Cipher[modes.CBC | modes.CTR | modes.GCM]:
     """Generate key + iv and return cipher."""
     if not password:
-        raise ValueError("Key is password-protected.")
+        raise TypeError(
+            "Key is password-protected, but password was not provided."
+        )
 
     ciph = _SSH_CIPHERS[ciphername]
     seed = _bcrypt_kdf(
@@ -251,14 +253,14 @@ def _to_mpint(val: int) -> bytes:
 class _FragList:
     """Build recursive structure without data copy."""
 
-    flist: list[bytes]
+    flist: list[utils.Buffer]
 
-    def __init__(self, init: list[bytes] | None = None) -> None:
+    def __init__(self, init: list[utils.Buffer] | None = None) -> None:
         self.flist = []
         if init:
             self.flist.extend(init)
 
-    def put_raw(self, val: bytes) -> None:
+    def put_raw(self, val: utils.Buffer) -> None:
         """Add plain bytes"""
         self.flist.append(val)
 
@@ -329,7 +331,7 @@ class _SSHFormatRSA:
         return public_key, data
 
     def load_private(
-        self, data: memoryview, pubfields
+        self, data: memoryview, pubfields, unsafe_skip_rsa_key_validation: bool
     ) -> tuple[rsa.RSAPrivateKey, memoryview]:
         """Make RSA private key from data."""
         n, data = _get_mpint(data)
@@ -347,7 +349,9 @@ class _SSHFormatRSA:
         private_numbers = rsa.RSAPrivateNumbers(
             p, q, d, dmp1, dmq1, iqmp, public_numbers
         )
-        private_key = private_numbers.private_key()
+        private_key = private_numbers.private_key(
+            unsafe_skip_rsa_key_validation=unsafe_skip_rsa_key_validation
+        )
         return private_key, data
 
     def encode_public(
@@ -403,7 +407,7 @@ class _SSHFormatDSA:
         return public_key, data
 
     def load_private(
-        self, data: memoryview, pubfields
+        self, data: memoryview, pubfields, unsafe_skip_rsa_key_validation: bool
     ) -> tuple[dsa.DSAPrivateKey, memoryview]:
         """Make DSA private key from data."""
         (p, q, g, y), data = self.get_public(data)
@@ -483,7 +487,7 @@ class _SSHFormatECDSA:
         return public_key, data
 
     def load_private(
-        self, data: memoryview, pubfields
+        self, data: memoryview, pubfields, unsafe_skip_rsa_key_validation: bool
     ) -> tuple[ec.EllipticCurvePrivateKey, memoryview]:
         """Make ECDSA private key from data."""
         (curve_name, point), data = self.get_public(data)
@@ -543,7 +547,7 @@ class _SSHFormatEd25519:
         return public_key, data
 
     def load_private(
-        self, data: memoryview, pubfields
+        self, data: memoryview, pubfields, unsafe_skip_rsa_key_validation: bool
     ) -> tuple[ed25519.Ed25519PrivateKey, memoryview]:
         """Make Ed25519 private key from data."""
         (point,), data = self.get_public(data)
@@ -612,6 +616,13 @@ class _SSHFormatSKEd25519:
         _, data = load_application(data)
         return public_key, data
 
+    def get_public(self, data: memoryview) -> typing.NoReturn:
+        # Confusingly `get_public` is an entry point used by private key
+        # loading.
+        raise UnsupportedAlgorithm(
+            "sk-ssh-ed25519 private keys cannot be loaded"
+        )
+
 
 class _SSHFormatSKECDSA:
     """
@@ -631,6 +642,13 @@ class _SSHFormatSKECDSA:
         _, data = load_application(data)
         return public_key, data
 
+    def get_public(self, data: memoryview) -> typing.NoReturn:
+        # Confusingly `get_public` is an entry point used by private key
+        # loading.
+        raise UnsupportedAlgorithm(
+            "sk-ecdsa-sha2-nistp256 private keys cannot be loaded"
+        )
+
 
 _KEY_FORMATS = {
     _SSH_RSA: _SSHFormatRSA(),
@@ -644,7 +662,7 @@ _KEY_FORMATS = {
 }
 
 
-def _lookup_kformat(key_type: bytes):
+def _lookup_kformat(key_type: utils.Buffer):
     """Return valid format or throw error"""
     if not isinstance(key_type, bytes):
         key_type = memoryview(key_type).tobytes()
@@ -662,9 +680,11 @@ SSHPrivateKeyTypes = typing.Union[
 
 
 def load_ssh_private_key(
-    data: bytes,
+    data: utils.Buffer,
     password: bytes | None,
     backend: typing.Any = None,
+    *,
+    unsafe_skip_rsa_key_validation: bool = False,
 ) -> SSHPrivateKeyTypes:
     """Load private key from OpenSSH custom encoding."""
     utils._check_byteslike("data", data)
@@ -696,7 +716,7 @@ def load_ssh_private_key(
     pubfields, pubdata = kformat.get_public(pubdata)
     _check_empty(pubdata)
 
-    if (ciphername, kdfname) != (_NONE, _NONE):
+    if ciphername != _NONE or kdfname != _NONE:
         ciphername_bytes = ciphername.tobytes()
         if ciphername_bytes not in _SSH_CIPHERS:
             raise UnsupportedAlgorithm(
@@ -731,6 +751,10 @@ def load_ssh_private_key(
             # should be no output from finalize
             _check_empty(dec.finalize())
     else:
+        if password:
+            raise TypeError(
+                "Password was given but private key is not encrypted."
+            )
         # load secret data
         edata, data = _get_sshstr(data)
         _check_empty(data)
@@ -745,7 +769,11 @@ def load_ssh_private_key(
     key_type, edata = _get_sshstr(edata)
     if key_type != pub_key_type:
         raise ValueError("Corrupt data: key type mismatch")
-    private_key, edata = kformat.load_private(edata, pubfields)
+    private_key, edata = kformat.load_private(
+        edata,
+        pubfields,
+        unsafe_skip_rsa_key_validation=unsafe_skip_rsa_key_validation,
+    )
     # We don't use the comment
     _, edata = _get_sshstr(edata)
 
@@ -1001,7 +1029,7 @@ def _get_ec_hash_alg(curve: ec.EllipticCurve) -> hashes.HashAlgorithm:
 
 
 def _load_ssh_public_identity(
-    data: bytes,
+    data: utils.Buffer,
     _legacy_dsa_allowed=False,
 ) -> SSHCertificate | SSHPublicKeyTypes:
     utils._check_byteslike("data", data)
@@ -1121,8 +1149,30 @@ def _parse_exts_opts(exts_opts: memoryview) -> dict[bytes, bytes]:
     return result
 
 
+def ssh_key_fingerprint(
+    key: SSHPublicKeyTypes,
+    hash_algorithm: hashes.MD5 | hashes.SHA256,
+) -> bytes:
+    if not isinstance(hash_algorithm, (hashes.MD5, hashes.SHA256)):
+        raise TypeError("hash_algorithm must be either MD5 or SHA256")
+
+    key_type = _get_ssh_key_type(key)
+    kformat = _lookup_kformat(key_type)
+
+    f_pub = _FragList()
+    f_pub.put_sshstr(key_type)
+    kformat.encode_public(key, f_pub)
+
+    ssh_binary_data = f_pub.tobytes()
+
+    # Hash the binary data
+    hash_obj = hashes.Hash(hash_algorithm)
+    hash_obj.update(ssh_binary_data)
+    return hash_obj.finalize()
+
+
 def load_ssh_public_key(
-    data: bytes, backend: typing.Any = None
+    data: utils.Buffer, backend: typing.Any = None
 ) -> SSHPublicKeyTypes:
     cert_or_key = _load_ssh_public_identity(data, _legacy_dsa_allowed=True)
     public_key: SSHPublicKeyTypes

py2docfx/venv/venv1/Lib/site-packages/cryptography/hazmat/primitives/twofactor/hotp.py

@@ -11,6 +11,7 @@ from urllib.parse import quote, urlencode
 from cryptography.hazmat.primitives import constant_time, hmac
 from cryptography.hazmat.primitives.hashes import SHA1, SHA256, SHA512
 from cryptography.hazmat.primitives.twofactor import InvalidToken
+from cryptography.utils import Buffer
 
 HOTPHashTypes = typing.Union[SHA1, SHA256, SHA512]
 
@@ -44,7 +45,7 @@ def _generate_uri(
 class HOTP:
     def __init__(
         self,
-        key: bytes,
+        key: Buffer,
         length: int,
         algorithm: HOTPHashTypes,
         backend: typing.Any = None,
@@ -84,7 +85,7 @@ class HOTP:
         try:
             ctx.update(counter.to_bytes(length=8, byteorder="big"))
         except OverflowError:
-            raise ValueError(f"Counter must be between 0 and {2 ** 64 - 1}.")
+            raise ValueError(f"Counter must be between 0 and {2**64 - 1}.")
 
         hmac_value = ctx.finalize()
 

py2docfx/venv/venv1/Lib/site-packages/cryptography/hazmat/primitives/twofactor/totp.py

@@ -13,12 +13,13 @@ from cryptography.hazmat.primitives.twofactor.hotp import (
     HOTPHashTypes,
     _generate_uri,
 )
+from cryptography.utils import Buffer
 
 
 class TOTP:
     def __init__(
         self,
-        key: bytes,
+        key: Buffer,
         length: int,
         algorithm: HOTPHashTypes,
         time_step: int,

py2docfx/venv/venv1/Lib/site-packages/cryptography/utils.py

@@ -9,6 +9,7 @@ import sys
 import types
 import typing
 import warnings
+from collections.abc import Callable, Sequence
 
 
 # We use a UserWarning subclass, instead of DeprecationWarning, because CPython
@@ -26,6 +27,17 @@ DeprecatedIn40 = CryptographyDeprecationWarning
 DeprecatedIn41 = CryptographyDeprecationWarning
 DeprecatedIn42 = CryptographyDeprecationWarning
 DeprecatedIn43 = CryptographyDeprecationWarning
+DeprecatedIn45 = CryptographyDeprecationWarning
+
+
+# If you're wondering why we don't use `Buffer`, it's because `Buffer` would
+# be more accurately named: Bufferable. It means something which has an
+# `__buffer__`. Which means you can't actually treat the result as a buffer
+# (and do things like take a `len()`).
+if sys.version_info >= (3, 9):
+    Buffer = typing.Union[bytes, bytearray, memoryview]
+else:
+    Buffer = typing.ByteString
 
 
 def _check_bytes(name: str, value: bytes) -> None:
@@ -33,7 +45,7 @@ def _check_bytes(name: str, value: bytes) -> None:
         raise TypeError(f"{name} must be bytes")
 
 
-def _check_byteslike(name: str, value: bytes) -> None:
+def _check_byteslike(name: str, value: Buffer) -> None:
     try:
         memoryview(value)
     except TypeError:
@@ -81,7 +93,7 @@ class _ModuleWithDeprecations(types.ModuleType):
 
         delattr(self._module, attr)
 
-    def __dir__(self) -> typing.Sequence[str]:
+    def __dir__(self) -> Sequence[str]:
         return ["_module", *dir(self._module)]
 
 
@@ -102,7 +114,7 @@ def deprecated(
     return dv
 
 
-def cached_property(func: typing.Callable) -> property:
+def cached_property(func: Callable) -> property:
     cached_name = f"_cached_{func}"
     sentinel = object()
 

py2docfx/venv/venv1/Lib/site-packages/cryptography/x509/__init__.py

@@ -66,6 +66,7 @@ from cryptography.x509.extensions import (
     PolicyInformation,
     PrecertificateSignedCertificateTimestamps,
     PrecertPoison,
+    PrivateKeyUsagePeriod,
     ProfessionInfo,
     ReasonFlags,
     SignedCertificateTimestamps,
@@ -115,6 +116,7 @@ OID_FRESHEST_CRL = ExtensionOID.FRESHEST_CRL
 OID_INHIBIT_ANY_POLICY = ExtensionOID.INHIBIT_ANY_POLICY
 OID_ISSUER_ALTERNATIVE_NAME = ExtensionOID.ISSUER_ALTERNATIVE_NAME
 OID_KEY_USAGE = ExtensionOID.KEY_USAGE
+OID_PRIVATE_KEY_USAGE_PERIOD = ExtensionOID.PRIVATE_KEY_USAGE_PERIOD
 OID_NAME_CONSTRAINTS = ExtensionOID.NAME_CONSTRAINTS
 OID_OCSP_NO_CHECK = ExtensionOID.OCSP_NO_CHECK
 OID_POLICY_CONSTRAINTS = ExtensionOID.POLICY_CONSTRAINTS
@@ -233,6 +235,7 @@ __all__ = [
     "PolicyInformation",
     "PrecertPoison",
     "PrecertificateSignedCertificateTimestamps",
+    "PrivateKeyUsagePeriod",
     "ProfessionInfo",
     "PublicKeyAlgorithmOID",
     "RFC822Name",

py2docfx/venv/venv1/Lib/site-packages/cryptography/x509/base.py

@@ -9,6 +9,7 @@ import datetime
 import os
 import typing
 import warnings
+from collections.abc import Iterable
 
 from cryptography import utils
 from cryptography.hazmat.bindings._rust import x509 as rust_x509
@@ -131,7 +132,7 @@ class Attribute:
 class Attributes:
     def __init__(
         self,
-        attributes: typing.Iterable[Attribute],
+        attributes: Iterable[Attribute],
     ) -> None:
         self._attributes = list(attributes)
 
@@ -330,6 +331,7 @@ class CertificateSigningRequestBuilder:
         backend: typing.Any = None,
         *,
         rsa_padding: padding.PSS | padding.PKCS1v15 | None = None,
+        ecdsa_deterministic: bool | None = None,
     ) -> CertificateSigningRequest:
         """
         Signs the request using the requestor's private key.
@@ -343,8 +345,18 @@ class CertificateSigningRequestBuilder:
             if not isinstance(private_key, rsa.RSAPrivateKey):
                 raise TypeError("Padding is only supported for RSA keys")
 
+        if ecdsa_deterministic is not None:
+            if not isinstance(private_key, ec.EllipticCurvePrivateKey):
+                raise TypeError(
+                    "Deterministic ECDSA is only supported for EC keys"
+                )
+
         return rust_x509.create_x509_csr(
-            self, private_key, algorithm, rsa_padding
+            self,
+            private_key,
+            algorithm,
+            rsa_padding,
+            ecdsa_deterministic,
         )
 
 
@@ -510,8 +522,7 @@ class CertificateBuilder:
         time = _convert_to_naive_utc_time(time)
         if time < _EARLIEST_UTC_TIME:
             raise ValueError(
-                "The not valid after date must be on or after"
-                " 1950 January 1."
+                "The not valid after date must be on or after 1950 January 1."
             )
         if (
             self._not_valid_before is not None
@@ -560,6 +571,7 @@ class CertificateBuilder:
         backend: typing.Any = None,
         *,
         rsa_padding: padding.PSS | padding.PKCS1v15 | None = None,
+        ecdsa_deterministic: bool | None = None,
     ) -> Certificate:
         """
         Signs the certificate using the CA's private key.
@@ -588,8 +600,18 @@ class CertificateBuilder:
             if not isinstance(private_key, rsa.RSAPrivateKey):
                 raise TypeError("Padding is only supported for RSA keys")
 
+        if ecdsa_deterministic is not None:
+            if not isinstance(private_key, ec.EllipticCurvePrivateKey):
+                raise TypeError(
+                    "Deterministic ECDSA is only supported for EC keys"
+                )
+
         return rust_x509.create_x509_certificate(
-            self, private_key, algorithm, rsa_padding
+            self,
+            private_key,
+            algorithm,
+            rsa_padding,
+            ecdsa_deterministic,
         )
 
 
@@ -717,6 +739,7 @@ class CertificateRevocationListBuilder:
         backend: typing.Any = None,
         *,
         rsa_padding: padding.PSS | padding.PKCS1v15 | None = None,
+        ecdsa_deterministic: bool | None = None,
     ) -> CertificateRevocationList:
         if self._issuer_name is None:
             raise ValueError("A CRL must have an issuer name")
@@ -733,8 +756,18 @@ class CertificateRevocationListBuilder:
             if not isinstance(private_key, rsa.RSAPrivateKey):
                 raise TypeError("Padding is only supported for RSA keys")
 
+        if ecdsa_deterministic is not None:
+            if not isinstance(private_key, ec.EllipticCurvePrivateKey):
+                raise TypeError(
+                    "Deterministic ECDSA is only supported for EC keys"
+                )
+
         return rust_x509.create_x509_crl(
-            self, private_key, algorithm, rsa_padding
+            self,
+            private_key,
+            algorithm,
+            rsa_padding,
+            ecdsa_deterministic,
         )